Spring Security
Go to file
Elias Lousseief 4aa9420047
Add support for validation of InResponseTo
Whenever an InResponseTo is present in the SAML2 response and / or any of its assertions, it will be validated against the stored SAML2 request. If the request is missing or the ID of the request does not match the InResponseTo, validation fails. If there is no InResponseTo, no validation of it is done (as opposed to checking whether there is a saved request or not and then failing based on that).

Closes gh-9174
2022-03-15 13:06:32 -06:00
.github Add missing output and checkout 2022-03-09 10:47:48 -06:00
.idea Fix checkstyle rules could not be parsed 2020-11-23 14:33:18 -05:00
acl Polish gh-10081 2021-11-23 15:52:45 -06:00
aspects Update aspectj-plugin to 6.3.0 2021-11-16 12:52:07 -06:00
bom fix bom 2021-05-17 22:29:45 -05:00
buildSrc Default next milestone when checking for open issues 2022-03-01 15:38:03 +01:00
config Add SecurityContextHolderFilter 2022-03-12 13:31:04 -06:00
core Add UsernamePasswordAuthenticationToken factory methods 2022-03-09 15:49:29 -07:00
crypto Rename prefix/suffix in DelegatingPasswordEncoder 2021-11-16 13:29:49 -06:00
data Update to Spring Framework 6.0 2021-11-01 09:02:42 -03:00
dependencies Remove spring-security-openid 2022-01-21 16:55:19 -06:00
docs Fix docs SecurityContextHolder Diagram 2022-03-12 13:44:12 -06:00
etc Add SAML 2.0 Login XML Support 2022-03-09 10:40:26 -03:00
gradle/wrapper Update to Gradle 7.3 2021-11-10 11:05:18 -03:00
itest Add UsernamePasswordAuthenticationToken factory methods 2022-03-09 15:49:29 -07:00
ldap Add UsernamePasswordAuthenticationToken factory methods 2022-03-09 15:49:29 -07:00
messaging Remove jcl-over-slf4j 2022-01-19 14:40:56 -06:00
oauth2 BearerTokenAuthenticationFilter.securityContextRepository 2022-03-09 15:47:34 -06:00
rsocket Add UsernamePasswordAuthenticationToken factory methods 2022-03-09 15:49:29 -07:00
saml2/saml2-service-provider Add support for validation of InResponseTo 2022-03-15 13:06:32 -06:00
scripts Fix bug label for generateChangelog task 2021-10-28 11:53:34 -05:00
taglibs Update to Spring Framework 6.0 2021-11-01 09:02:42 -03:00
test Add SecurityContextHolderFilter 2022-03-12 13:31:04 -06:00
web Add SecurityContextHolderFilter 2022-03-12 13:31:04 -06:00
.editorconfig Fixed link in .editorconfig 2021-10-13 15:36:10 -06:00
.gitattributes Install Structure101 Plugin 2021-09-27 14:56:03 -06:00
.gitignore Ignore Lock Files 2020-02-07 13:59:05 -06:00
.sdkmanrc Add .sdkmanrc 2022-02-18 13:50:07 -06:00
CONTRIBUTING.adoc master->main 2021-04-26 16:55:43 -05:00
LICENSE.txt Add LICENSE.txt 2020-04-15 16:44:13 -05:00
README.adoc Upgrade to JDK 17 2021-11-01 09:02:42 -03:00
RELEASE.adoc Update RELEASE.adoc for antora.yml 2022-01-04 15:50:42 -06:00
build.gradle Add gradle task to update project version 2022-03-01 09:48:35 +01:00
class_mapping_from_2.0.x.txt SEC-1148: Simple classname mapping from 2.0 to 3.0 2009-12-02 22:44:30 +00:00
gradle.properties Upgrade to Kotlin 1.6.20-M1 2022-02-22 08:51:27 -03:00
gradlew Update to Gradle 7.3 2021-11-10 11:05:18 -03:00
gradlew.bat Update to Gradle 6.6.1 2020-10-12 17:41:16 -06:00
notice.txt URL Cleanup 2019-03-19 23:53:23 -05:00
settings.gradle Bump up Gradle plugin dependencies 2022-01-18 14:22:16 +01:00

README.adoc

image::https://badges.gitter.im/Join%20Chat.svg[Gitter,link=https://gitter.im/spring-projects/spring-security?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge]

image:https://github.com/spring-projects/spring-security/workflows/CI/badge.svg?branch=main["Build Status", link="https://github.com/spring-projects/spring-security/actions?query=workflow%3ACI"]

image:https://img.shields.io/badge/Revved%20up%20by-Gradle%20Enterprise-06A0CE?logo=Gradle&labelColor=02303A["Revved up by Gradle Enterprise", link="https://ge.spring.io/scans?search.rootProjectNames=spring-security"]

= Spring Security

Spring Security provides security services for the https://docs.spring.io[Spring IO Platform]. Spring Security 6.0 requires Spring 6.0 as
a minimum and also requires Java 17.

For a detailed list of features and access to the latest release, please visit https://spring.io/projects[Spring projects].

== Code of Conduct
Please see our https://github.com/spring-projects/.github/blob/main/CODE_OF_CONDUCT.md[code of conduct]

== Downloading Artifacts
See https://docs.spring.io/spring-security/site/docs/current/reference/html5/#getting[Getting Spring Security] for how to obtain Spring Security.

== Documentation
Be sure to read the https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/[Spring Security Reference].
Extensive JavaDoc for the Spring Security code is also available in the https://docs.spring.io/spring-security/site/docs/current/api/[Spring Security API Documentation].

== Quick Start
See https://docs.spring.io/spring-security/site/docs/current/reference/html5/#servlet-hello[Hello Spring Security] to get started with a "Hello, World" application.

== Building from Source
Spring Security uses a https://gradle.org[Gradle]-based build system.
In the instructions below, https://vimeo.com/34436402[`./gradlew`] is invoked from the root of the source tree and serves as
a cross-platform, self-contained bootstrap mechanism for the build.

=== Prerequisites
https://help.github.com/set-up-git-redirect[Git] and the https://www.oracle.com/technetwork/java/javase/downloads[JDK17 build].

Be sure that your `JAVA_HOME` environment variable points to the `jdk-17` folder extracted from the JDK download.

=== Check out sources
[indent=0]
----
git clone git@github.com:spring-projects/spring-security.git
----

=== Install all spring-\* jars into your local Maven cache
[indent=0]
----
./gradlew publishToMavenLocal
----

=== Compile and test; build all jars, distribution zips, and docs
[indent=0]
----
./gradlew build
----

Discover more commands with `./gradlew tasks`.
See also the https://github.com/spring-projects/spring-framework/wiki/Gradle-build-and-release-FAQ[Gradle build and release FAQ].

== Getting Support
Check out the https://stackoverflow.com/questions/tagged/spring-security[Spring Security tags on Stack Overflow].
https://spring.io/services[Commercial support] is available too.

== Contributing
https://help.github.com/articles/creating-a-pull-request[Pull requests] are welcome; see the https://github.com/spring-projects/spring-security/blob/main/CONTRIBUTING.adoc[contributor guidelines] for details.

== License
Spring Security is Open Source software released under the
https://www.apache.org/licenses/LICENSE-2.0.html[Apache 2.0 license].